    /*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */

package web;

import conexion.bd_odbc_jdbc;
import java.io.*;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.*;
import javax.servlet.http.*;

/**
 *
 * @author oem sony
 */
public class Login extends HttpServlet {
   
    /** 
    * Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
    * @param request servlet request
    * @param response servlet response
    */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException, SQLException {
      
            String login = request.getParameter("login");

            login= login.replace("--", "");
            login= login.replace("'", "");
            login= login.replace("SELECT", "");
            login= login.replace("OR", "");
            login= login.replace("AND", "");
            login= login.replace("LIKE", "");
            String passwd =  request.getParameter("passwd");
            passwd= passwd.replace("--", "");
            passwd= passwd.replace("'", "");
            passwd= passwd.replace("SELECT", "");
            passwd= passwd.replace("OR", "");
            passwd= passwd.replace("AND", "");
            passwd= passwd.replace("LIKE", "");



            try{
                //Connection conn = (Connection) DriverManager.getConnection("jdbc:mysql://localhost:3306/is2-sqli1","root","admin");
//                String driver = "com.mysql.jdbc.Driver";
                
//                Class.forName(driver).newInstance();

                bd_odbc_jdbc b = new bd_odbc_jdbc();
                Connection conn = b.crearConexionJDBC();
//                conn = (Connection) DriverManager.getConnection("jdbc:mysql://localhost:3306/is2-sqlin","root","root");
                String query = "SELECT * from customer where login='" + login + "' and passwd ='" + passwd + "'";
                System.out.println(query);
                
                Statement s = conn.createStatement();
                ResultSet rs = s.executeQuery(query);

                 if(rs.next()){
                    response.sendRedirect("main.jsp");

                }
                else{
                      response.sendRedirect("error.jsp");
                 }

                 rs.close();
                 s.close();
                 conn.close();
          } catch(Exception e) {
             System.out.println("Exception: "+ e);
             e.printStackTrace();
          }

           
            //Connection conn = (Connection) DriverManager.getConnection("jdbc:mysql://localhost:3306/is2-sqli1","root","admin");
            
        
       
    } 

    // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
    /** 
    * Handles the HTTP <code>GET</code> method.
    * @param request servlet request
    * @param response servlet response
    */
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        try {
            processRequest(request, response);
        } catch (SQLException ex) {
            Logger.getLogger(Login.class.getName()).log(Level.SEVERE, null, ex);
        }
    } 

    /** 
    * Handles the HTTP <code>POST</code> method.
    * @param request servlet request
    * @param response servlet response
    */
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        try {
            processRequest(request, response);
        } catch (SQLException ex) {
            Logger.getLogger(Login.class.getName()).log(Level.SEVERE, null, ex);
        }
    }

    /** 
    * Returns a short description of the servlet.
    */
    public String getServletInfo() {
        return "Short description";
    }
    // </editor-fold>
}
